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Background of Invention 
l \t Field of the Invention 

ijOOOl] The present invention relates to a network administration apparatus, a network 

administrating program, a network administrating method and a computer network system. 
More particularly, the present invention relates to a MAC (Media Access Control) address-based 
VLAN (Virtual Local Area Network) that can be configured based upon selected identifying 
information from a network device, which allows efficient VLAN settings with high security. 

Description of the Related Art 

[0002] 

A network administration apparatus or an interconnecting device that configures a MAC 
address-based VLAN includes a database in which a MAC address of a network device and a 
VLAN group to which the network device belongs are stored in such a manner that the MAC 
address and the VLAN group correspond to each other. When receiving a MAC address in a 
packet from a certain network device, the network administration apparatus or interconnecting 
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device recognizes the VLAN group of the network device based on the received MAC address, 
and assigns the registered VLAN group to the network device. 

[0003] In a computer network system forming a conventional type MAC address-based VLAN, 

however, a network administrator has to update the database in which the MAC address and the 
corresponding VLAN group are stored when a VLAN group is newly created, the VLAN group of 
a certain network device is changed, or a new network device is connected to the network, for 
example. 

Summary of Invention 

[0004] Therefore, it is an object of the present invention to provide a network administration 

apparatus, a network administrating program, a network administrating method and a 
p computer network system, which are capable of overcoming the above drawbacks 

jJJJ accompanying the conventional art. The above and other objects can be achieved by 
CO combinations described in the independent claims. The dependent claims define further 
advantageous and exemplary combinations of the present invention. 

if""' 1 

tQlQOS] According to the first aspect of the present invention, a network administration apparatus 

lit 

for administrating a network device that performs communication in a network, comprising; a 
^ VLAN information database operable to store one or more VLAN groups to which one or more 

ru 

£ network devices connected to the network are to belong, and one or more units of device 
M identifying information respectively specifying the one or more network devices, each of the 
one or more VLAN groups corresponding to at least one unit of device identifying information; 
a receiving unit operable to receive device identifying information of a network device 
therefrom; a database updating unit operable to store the received device identifying 
information to correspond to a VLAN group to which the network device having the received 
device identifying information is to belong in the VLAN information database; and a setting unit 
operable to assign the VLAN group stored in the VLAN information database that corresponds 
to the received device identifying information to the network device having the received device 
identifying information. 

[0006] The device identifying information may be a MAC address of the network device. 

[0007] The VLAN information database may further store user identifying information, specifying a 
user of the network device, to correspond to the VLAN group of the network device, the 
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receiving unit may further receive the user identifying information from the network device, and 
the database updating unit may store the device identifying information in the VLAN 
information database to correspond to the user identifying information and the VLAN group, in 
a case where the VLAN information database has already stored the user identifying information 
received by the receiving unit. 

The receiving unit may receive the device identifying information of the network device, 
which belongs to a default VLAN group in the VLAN information database, from the network 
device, and the setting unit may assign, in a case where the device identifying information 
received by the receiving unit is included in the one or more units of device identifying 
information stored in the VLAN information database, the VLAN group corresponding to the 
received device identifying information to the network device of the default VLAN group. 

The VLAN information database may further store one or more units of user identifying 
information respectively specifying users of the one or more network devices in such a manner 
that each unit of user identifying information corresponds to one of the one or more VLAN 
groups, the receiving unit may further receive, in a case where the received device identifying 
information is not stored in the VLAN information database, user identifying information from 
the network device of the default VLAN group, the database updating unit may store the device 
identifying information of the network device received by the receiving unit to correspond to 
the user identifying information and the VLAN group thereof in a case where the user 
identifying information received by the receiving unit is stored in the VLAN information 
database, and the setting unit may assign the VLAN group in the VLAN information database, 
that corresponds to the received device identifying information, to the network device of the 
default VLAN group. 

[001 0] The network administration apparatus may further comprise a detecting unit operable to 
detect a new network device that has been newly connected to the network or turned on, and 
the receiving unit may receive device identifying information of the new network device 
detected by the detecting unit from the new network device. 

[001 1] detecting unit may further detect one of the one or more network devices that has been 

removed from the network or turned off, the detected network device having corresponding 
device identifying information stored in the VLAN information database, and the database 
updating unit may delete the corresponding device identifying information from the VLAN 
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information database for the detected network device. 

[001 2] The database updating unit may delete the corresponding device identifying information of 
the network device detected by the detecting unit from the VLAN information database when a 
predetermined time period has passed after detection that the network device has been 
removed from the network or turned off. 

[001 3] The setting unit may assign a default VLAN group to a connection port of an 

interconnecting device corresponding to the network device detected by the detecting unit. 

[001 4] The network administration apparatus may belong to the default VLAN group, and the 
receiving unit may receive device identifying information of a network device of the default 
VLAN group therefrom by being connected to the connection port to which the default VLAN 

HI group is assigned. 

3 

(pbl 5] According to the second aspect of the present invention, a network administrating program 

Si 

fdj for administrating a network device that performs communication in a network, comprising: a 

^ storing module operable to store one or more VLAN groups to which one or more network 

%j devices connected to the network are to belong, and one or more units of device identifying 

Si 

m information respectively specifying the one or more network devices, each of the one or more 
% * VLAN groups corresponding to at least one unit of device identifying information; a receiving 
j;;- module operable to receive device identifying information of a network device therefrom; a 
^ database-updating module operable to store the received device identifying information to 

correspond to a VLAN group to which the network device having the received device identifying 
information is to belong; and a setting module operable to assign the VLAN group that 
corresponds to the received device identifying information, to the network device having the 
received device identifying information. 

[001 6] The storing module may further store user identifying information, specifying a user of the 
network device, to correspond to the VLAN group of the network device, the receiving module 
may further receive the user identifying information from the network device, and the 
database-updating module may store the device identifying information to correspond to the 
user identifying information and the VLAN group, in a case where the storing module has 
already stored the user identifying information received by the receiving module. 

[001 7] jh e receiving module may receive the device identifying information of the network device, 
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which belongs to a default VLAN group different from said one or more VLAN groups in said 
VLAN information database, from the network device, and the setting module may assign, in a 
case where the device identifying information received by the receiving module is included in 
the one or more units of device identifying information stored by the storing module, one of 
the one or more VLAN groups that corresponds to the received device identifying information to 
the network device of the default VLAN group. 

[001 8] The storing module may further store one or more units of user identifying information 
respectively specifying users of the one or more network devices in such a manner that each 
unit of user identifying information corresponds to one of the one or more VLAN groups, the 
receiving module may further receive, in a case where the received device identifying 
information is not stored by the storing module, the user identifying information of the network 

□ device of the default VLAN group, the database-updating module may store the device 

identifying information of the network device received by the receiving module to correspond to 



the user identifying information and the VLAN group thereof in a case where the user 



identifying information received by the receiving module is stored by the storing module, and 



the setting module may assign the VLAN group that corresponds to the received device 



identifying information to the network device of the default VLAN group. 




detect a new network device that has been newly connected to the network or turned on, and 



The network administrating program may further comprise a detecting module operable to 



f 



the receiving module may receive device identifying information of the new network device 
detected by the detecting module from the new network device. 



[0020] 



The detecting module may further detect one of the one or more network devices that has 



been removed from the network or turned off, the detected network device having 



corresponding device identifying information, and the database-updating module may delete 



the corresponding device identifying information for the detected network device. 



[0021] 



The database-updating module may delete the corresponding device identifying 
information of the network device detected by the detecting module, when a predetermined 
time period has passed after detection that the network device has been removed from the 



network or turned off. 



[0022] 



The setting module may assign a default VLAN group to a connection port of an 
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interconnecting device corresponding to the network device detected by the detecting module. 

The receiving module may receive device identifying information of a network device of the 
default VLAN group therefrom by being connected to the connection port to which the default 
VLAN group is assigned. 

According to the third aspect of the present invention, a network administrating method for 
use in a network administration apparatus operable to administrate a network device that 
performs communication in a network, the network administration apparatus comprising a 
VLAN information database for storing one or more VLAN groups to which one or more network 
devices connected to the network are to belong, and one or more units of device identifying 
information respectively specifying the one or more network devices, each of the one or more 
VLAN groups corresponding to at least one unit of device identifying information, the method 
comprising: receiving device identifying information of a network device therefrom; storing 
received device identifying information to correspond to a VLAN group to which the network 
device having the received device identifying information is to belong; and assigning the VLAN 
group that corresponds to the received device identifying information to the network device 
having the received device identifying information. 

The network administrating method may further comprise storing user identifying 
information, specifying a user of the network device, to correspond to the VLAN group of the 
network device, and storing the received device identifying information to correspond to the 
stored user identifying information and the VU\N group. 

The network administrating method may further comprise receiving device identifying 
information of the network device, which belongs to a default VLAN group, and in a case where 
the received device identifying information is included in the stored device identifying 
information, assigning one of the one or more VLAN groups that corresponds to the received 
device identifying information to the network device of the default VLAN group. 

The network administrating method may further comprise storing one or more units of user 
identifying information respectively specifying users of the one or more network devices in 
such a manner that each unit of user identifying information corresponds to one of the one or 
more VLAN groups, in a case where the received device identifying information is not included 
in the stored device identifying information, storing the device identifying information of the 



network device of the default VLAN group to correspond to the stored user identifying 
information and the VLAN group thereof, and assigning the VLAN group that corresponds to 
the device identifying information of the network device of the default VLAN group to the 
network device. 

[0028] The network administrating method may further comprise detecting a new network device 
that has been newly connected to the network or turned on, and receiving detected device 
identifying information of the new network device. 

[0029] The network administrating method may further comprise detecting one of the one or more 
network devices that has been removed from the network or turned off, and deleting 
corresponding device identifying information for the detected network device. 

j©p30] The device identifying information of the network device may be deleted when a 

predetermined time period has passed after detection that the network device has been 

CP 

CO removed from the network or turned off. 

r|i 

Cjt)31] The network administrating method may further comprise assigning a default VLAN group 
■d to a connection port of an interconnecting device corresponding to the detected network 
device. 



U 



The device identifying information of a network device of the default VLAN group may be 
received therefrom by connecting to the connection port towhich the default VLAN group is 

■as? 

H assigned. 

[0033] According to the fourth aspect of the present invention, a computer network system 

comprising a network device operable to perform communication in a network, and a network 
administration apparatus operable to administrate the network device, wherein the network 
administration apparatus comprises: a VLAN information database operable to store one or 
more VLAN groups to which one or more network devices connected to the network are to 
belong, and one or more units of device identifying information respectively specifying the one 
or more network devices, each of the one or more VLAN groups corresponding to at least one 
unit of device identifying information; a receiving unit operable to receive, from the network 
device, device identifying information thereof; a database updating unit operable to store the 
received device identifying information to correspond to a VLAN group to which the network 
device having the received device identifying information is to belong; and a setting unit 
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operable to assign the VLAN group that corresponds to the received device identifying 
information to the network device having the received device identifying information. 

[0034] The VLAN information database may further store user identifying information, specifying a 
user of the network device, to correspond to the VLAN group of the network device, the 
receiving unit may further receive the user identifying information from the network device, and 
the database updating unit may store the device identifying information in the VLAN 
information database to correspond to the user identifying information and the VLAN group in 
a case where the VLAN information database has already stored the user identifying information 
received by the receiving unit. 

[0035] The receiving unit may receive the device identifying information of the network device, 
which belongs to a default VLAN group, from the network device, and the setting unit may 

□ 

assign, in a case where the device identifying information received by the receiving unit is 

™* included in the one or more units of device identifying information stored in the VLAN 

CO 

f|| information database, one of the one or more VLAN groups that corresponds to the received 

1:4 
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device identifying information to the network device of the default VLAN group. 



[0036] The VLAN information database may further store one or more units of user identifying 
f information respectively specifying users of the one or more network devices in such a manner 



f|j that each unit of user identifying information corresponds to one of the one or more VLAN 
pi groups, the receiving unit may further receive, in a case where the received device identifying 
information is not stored in the VLAN information database, the user identifying information of 
the network device of the default VLAN group, the database updating unit may store the device 
identifying information of the network device received by the receiving unit to correspond to 
the user identifying information and the VLAN group thereof in a case where the user 
identifying information received by the receiving unit is stored in the VLAN information 
database, and the setting unit may assign the VLAN group that corresponds to the device 
identifying information of the network device of the default VLAN group, to the network device. 

[0037] The network administration apparatus may further comprise a detecting unit operable to 
detect a new network device that has been newly connected to the network or turned on, and 
the receiving unit may receive device identifying information of the new network device 
detected by the detecting unit from the new network device. 
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The detecting unit may further detect one of the one or more network devices that has been 
removed from the network or turned off, the detected network device having corresponding 
device identifying information stored in the VLAN information database, and the database 
updating unit may delete the corresponding device identifying information from the VLAN 
information database for the detected network device. 

The database updating unit may delete the corresponding device identifying information of 
the network device detected by the detecting unit from the VLAN information database when a 
predetermined time period has passed after detection that the network device has been 
removed from the network or turned off. 

The computer network system may further comprise an interconnecting device operable to 
connect the network administration apparatus and the network device. In this case, the setting 
unit may assign a default VLAN group, to a connection port of the interconnecting device 
corresponding to the network device detected by the detecting unit. 

The network administration apparatus may belong to the default VLAN group, and the 
receiving unit may receive device identifying information of a network device of the default 
VLAN group therefrom by being connected to the connection port to which the default VLAN 
group is assigned. 

The summary of the invention does not necessarily describe all necessary features of the 
present invention. The present invention may also be a sub-combination of the features 
described above. The above and other features and advantages of the present invention will 
become more apparent from the following description of the embodiments taken in conjunction 
with the accompanying drawings. 

Brief Description of Drawings 

[0043] Fig. 1 shows an exemplary structure of a computer network system according to an 
embodiment of the present invention. 

[0044] Fig. 2 shows an exemplary structure of a network administration apparatus according to the 
embodiment of the present invention. 

[0045] Fig. 3 shows an exemplary data format of a VLAN information file stored in a VLAN 
information database. 
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[0046] Fig. 4 is a flowchart of a procedure for setting a VLAN group by the network administration 
apparatus according to the embodiment of the present invention. 

[0047] Fig. 5 is a flowchart of a procedure for setting a default VLAN group by the network 
administration apparatus according to the embodiment of the present invention. 

[0048] Fig. 6 shows a hardware configuration of the network administration apparatus 10 
according to the embodiment of the present invention. 

Detailed Description 

[0049] The invention will now be described based on the preferred embodiments, which do not 
intend to limit the scope of the present invention, but exemplify the invention. All of the 
features and the combinations thereof described in the embodiment are not necessarily 
essential to the invention. 



IU 



ill 



[0052] 



Fig. 1 illustrates a structure of a computer network system according to an embodiment of 
the present invention. The computer network system of the present embodiment includes 
network devices 14a ? 14b, 14c and 14d each of which performs communication through a 
network, a network administration apparatus 10 that administrates the network devices 14a, 
1 4b, 1 4c and 1 4d, and interconnecting devices 1 2a, 1 2b and 1 2c that connect the network 
devices 1 4a, 1 4b, 1 4c and 1 4d to the network administration apparatus 1 0. 



§0051] The network administration apparatus 10 receives from each of the network devices 14a, 



14b, 14c and 14d a MAC address thereof. The MAC address is an example of device identifying 
information that specifies the network device. The network administration apparatus 1 0 sets 
VLAN groups of the respective network devices 14a, 14b, 14c and 14d based on the received 
MAC addresses. More specifically, the network administration apparatus 10 assigns the VLAN 
group for the network devices 14a, 14b, T4c and 14d and the corresponding connection ports 
1 6c, 1 6d, 1 6e and 1 6f of the interconnecting devices 1 2b and 1 2c, thereby enabling the 
network devices 14a, 14b, 14c and 14d to perform communications in the respective VLANs. 

The interconnecting devices 1 2b and 12c may be wireless interconnecting devices that can 
perform wireless communications with the network devices 14a, 14b, 14c and 14d. In the 
computer network system including the wireless interconnecting devices, even if a location of 
the network device is changed, it is possible for the network device to perform wireless 
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communication in the VLAN group to which the network device belongs by forming the MAC 
address-based VLAN, without changing the setting of the network device. 

[0053] The network administration apparatus 10 receives, from each of the interconnecting devices 
1 2b and 1 2c, the MAC address thereof, and sets the VLAN groups of the interconnecting 
devices 1 2b and 1 2c based on the received MAC addresses. In this case, the network 
administration apparatus 1 0 enables the interconnecting devices 1 2b and 1 2c to perform 
communications in the respective VLANs by assigning the VLAN group, to which the 
interconnecting devices 1 2b and 1 2c are to belong, to the connection ports 1 6a and 1 6b of the 
interconnecting device 1 2a to which the interconnecting devices 1 2b and 1 2c are respectively 
connected. 

[0054] The network administration apparatus 1 0 may enable the interconnecting device 1 2b to 

perform communications in a plurality of VLANs by setting the connection port 1 6a of the 

P interconnecting device 1 2a to a plurality of VLAN groups. For example, the network 

ffl 

administration apparatus 1 0 enables the network devices 1 4a and 1 4b connected to the 
interconnecting device 1 2b to perform communications in VLAN 1 or 2 by setting the 
%j connection port 16a of the interconnecting device 1 2a to the VLAN 1 or 2. 



The computer network system of the present embodiment may add a tag for specifying a 
VLAN to an Ethernet frame. In other words, the MAC address-based VLAN of the present 
embodiment may be combined with a tagging VLAN, in which the VLAN is divided based on 
M* information of the tag, or a multiple VLAN, in which a given connection port is made to belong 
to a plurality of VLAN groups. 

[0056] Moreover, the network administration apparatus 10 may assign the VLAN groups of the 
interconnecting devices 1 2b and 1 2c to the connection ports 1 6a and 1 6b of the 
interconnecting device 1 2a by using a port-based VLAN, while setting the VLAN groups of the 
network devices 14a and 14b in the interconnecting device 12b and the VLAN groups of the 
network devices 14c and 14d in the interconnecting device 12c by using the MAC address- 
based VLAN. 

[0057] According to the computer network system of the present embodiment, a more flexible 
network can be configured by using a combination of the port-based VLAN and the MAC 
address-based VLAN of the present embodiment. 
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[0058] Fig. 2 illustrates a structure of the network administration apparatus 1 0 according to the 
present embodiment. The network administration apparatus 10 includes a VLAN information 
database 1 00 that stores a MAC address and a VLAN group of each of one or more network 
devices so as to correspond to each other, a receiving unit 102 that receives from a network 
device a MAC address thereof, a database updating unit 104 that stores the MAC address 
received by the receiving unit 1 02 in the VLAN information database 1 00, a setting unit 1 06 
that assigns a desired VLAN group to a network device based on the information stored in the 
VLAN information database 100, and a detecting unit 108 that detects a network device newly 
connected to a network. 

[0059] The detecting unit 1 08 detects the network device newly connected to the network or a 

network device in the network that has just been turned on. The receiving unit 102 then 
p receives from the network device detected by the detecting unit 1 08 a MAC address thereof. 

5*; The database updating unit 104 stores the MAC address received by the receiving unit 102 in 

fcrt the VLAN information database 1 00 in such a manner that the received MAC address 

corresponds to the VLAN group to which the network device having the received MAC address 
is to belong. The setting unit 106 then assigns the VLAN group stored in the VLAN information 
database 1 00 that corresponds to the received MAC address to the network device having the 
received MAC address. 



rj 
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The detecting unit 108 also detects a network device that has been removed from the 
network or that has been turned off. The database updating unit 104 then deletes the MAC 
address of the detected network device from the VLAN information database 100. The setting 
unit 1 06 assigns a default VLAN group to a connection port of an interconnecting device for the 
network device detected by the detecting unit 108, i.e., the default VLAN group is assigned to 
network devices which have not been authorized by the network administration apparatus 1 0. 
Further, the setting unit 106 may assign the default VLAN group to a deleted network device 
that has been removed or turned off as described above. Alternatively, the database updating 
unit 104 may delete the MAC address of the network device detected by the detecting unit 108 
from the VLAN information database 100 when a predetermined time period has passed after 
detection that the network device was removed from the network or was turned off. Moreover, 
the VLAN information database 1 00 may store the MAC address of the detected network device 
so as to correspond to the default VLAN group. 
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[0061 ] According to the network administration apparatus 1 0 of the present embodiment, the 

database updating unit 1 04 stores a MAC address of a certain network device received by the 
receiving unit 102 from that network device. Thus, the network administrator can form the MAC 
address-based VLAN easily without registering MAC addresses of network devices in the VLAN 
information database 100 in advance. In addition, in the present embodiment, the network 
administration apparatus 1 0 deletes the MAC address of the network device that was removed 
from the network or was turned off from the VLAN information database 1 00 and assigns the 
default VLAN group to the network device having the deleted MAC address. Thus, it is possible 
to prevent improper entry to the VLAN. 

[0062] Fig. 3 shows an exemplary data format of a VLAN information file stored in the VLAN 

information database 100. The VLAN information file includes a VLAN group field, a user ID 
Q field, a password field and a MAC address field. The VLAN group field stores information for 

JjJ specifying a type of a VLAN. The user ID field stores user identifying information that specifies 

88 a user of a network device. The password field stores a password used for certifying the user 

til 

specified by the user identifying information in the associated user ID field. The MAC address 
^ field stores a MAC address of a network device that is to belong to the VLAN group specified by 

a the associated VLAN group field. 

O 

[o|063] The user identifying information and the password that are to be stored in the user ID field 
j:* and the password field, respectively, are registered by the user of the network device or the 
m network administrator in advance. The MAC address received by the receiving unit 102 (see Fig. 

2) from the network device through the network is stored in the MAC address field. The user of 
the network device logs in the network administration apparatus 10 by means of the network 
device and inputs the user ID and password. The database updating unit 104 of the network 
administration apparatus 10 stores the MAC address received by the receiving unit 102 after 
certifying the user ID and the password that have been input by using the user identifying 
information and the password stored in the user ID field and the password field, respectively. 

[0064] 

In a case of a network device that cannot log in the network administration apparatus 1 0 
through the network to send the user ID and the password to the network administration 
apparatus 10, the MAC address of the network device may be registered in advance in the VLAN 
information file in the VLAN information database 100 so as to correspond to a desired VLAN 
group. The setting unit 1 06 assigns the VLAN group specified by the VLAN group field to the 
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network device having the MAC address stored in the corresponding MAC address field. 



[0065] According to the network administration apparatus 10 of the present embodiment, it is 
possible to certify the user ID and password input in the network device by using the user ID 
and password registered in advance and to register the MAC address of the network device that 
has been certified. Thus, the administrator can form a MAC address-based VLAN not by 
registering the MAC address, that is typically a complicated character string, in the VLAN 
information database 1 00, but by registering the user ID and the password therein. 



[0066] Fig. 4 is a flowchart of a VLAN setting procedure in the network administration apparatus 
10. First, the detecting unit 108 detects a network device that has been connected to the 
network or has just been turned on (SI 00). More specifically, the detecting unit 108 receives 
information of a connection port of an interconnecting device based on linkUp trap from the 

o 

!*nj interconnecting device so as to detect the network device newly connected to the network or 
^ that has just been turned on. 

m 

raj 

|(J067] In a case where a MAC address of a network device is added to the information of the 
^ connection port of the interconnecting device, the interconnecting device may send the added 

a; MAC address to the network administration apparatus 1 0. In this case, the detecting unit 1 08 

f*% 

* B * detects the network device newly connected to the network or turned on by receiving the MAC 
fU address from the interconnecting device. 

f0O68] The network device newly connected to the network or newly turned on is set to belong to 
the default VLAN group since the default VLAN group is assigned to the connection port of the 
interconnecting device that is not performing communication, and then performs 
communication with the network administration apparatus 10 that belongs to the default VLAN 
group. Then, the receiving unit 102 of the network administration apparatus 10 receives the 
MAC address of the network device to which the default VLAN group is assigned and has been 
detected by the detecting unit 108 therefrom (SI 02). 



[0069] 

The database updating unit 104 then refers to the VLAN information database 100 (SI 04), 
and determines whether or not the MAC address received by the receiving unit 102 is stored in 
the VLAN information database 100 (SI 06). In a case where the database updating unit 104 
determines that the received MAC address is stored in the VLAN information database 1 00 in 
Step SI 06, the setting unit 1 06 changes the VLAN setting of the network device that belongs to 
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the default VLAN group so as to belong to the other VLAN group that is stored in the VLAN 
information database 100 to correspond to the MAC address received by the receiving unit 102 
(SI 16). 

[0070] In another case where the database updating unit 1 04 does not determine that the MAC 
address received by the receiving unit 102 is stored in the VLAN information database 100 in 
Step SI 06, the receiving unit 102 receives, from the network device belonging to the default 
VLAN group, the user ID and the password thereof (SI 08). The database updating unit 104 then 
refers to the VLAN information database 100 (SI 10), and certifies the user ID and the password 
received by the receiving unit 102 (SI 1 2). When the user ID and the password are not certified 
in Step SI 12, the setting unit 106 does not change the VLAN setting of the network device that 
belongs to the default VLAN group. 

[0071 ] When the user ID and the password have been successfully certified in Step SI 1 2, the 

^ database updating unit 104 then stores the MAC address received by the receiving unit 102 in 

if|J the VLAN information database 100 in such a manner that the received MAC address 

u* . 

I corresponds to the user ID and the password both received by the receiving unit 1 02 (SI 1 4). 

\! The setting unit 1 06 then changes the VLAN setting of the network device that belongs to the 
J*j default VLAN group so as to make that network device belong to the VLAN group stored in the 

^ VLAN information database 1 00 to correspond to the user ID and the password received by the 

ft! • 

B p receiving unit 1 02 (SI 1 6). 

f0t>72] Fig. 5 is a flowchart of a procedure for assigning the default VLAN group to a network 
device in the network administration apparatus 10. First, the detecting unit 108 detects the 
network device that has been removed from the network or has been turned off (S200). More 
specifically, the detecting unit 108 receives information of the connection port of the 
interconnecting device based on linkDown trap from the interconnecting device, so as to detect 
the network device removed from the network or turned off. 

[0073] In a case where a MAC address of a network device is deleted from the information of the 
connection port of the interconnecting device, the interconnecting device may send the deleted 
MAC address to the network administration apparatus 1 0. The detecting unit 1 08 then detects 
the network device removed from the network or turned off by receiving the MAC address from 
the interconnecting unit. 



Page 15 of 35 



[0074] Then, the receiving unit 102 receives, from the interconnecting device to which network 
device detected by the detecting unit 108 is connected, the MAC address thereof (S202). In a 
case where a predetermined time period has passed after the communication from the network 
device having the MAC address received by the receiving unit 102 was stopped (S204), the 
database updating unit 104 deletes the received MAC address from the VLAN information 
database 1 00 (S206). The setting unit 1 06 then assigns the default VLAN group to the 
connection port of the interconnecting device for the network device detected by the detecting 
unit 108 (S208). 

In an alternative embodiment, an effective time period in which each network device can 
perform communication in the VLAN may be determined in advance, and the database updating 
unit 104 may delete from the VLAN information database 1 00 the MAC address of the network 
device for which the predetermined effective time period has passed. Moreover, in response to 
a deletion request from the user of the network device, the network administrator may delete 
the MAC address of the network device for which the deletion request has been issued from the 
VLAN information database 100. 

According to the present embodiment, the network administration apparatus 100 certifies 
the user of the network device and registers the MAC address of the network device of the 
certified user in the VLAN information database 100. Thus, a high-security MAC address-based 
VLAN can be formed. Moreover, it is possible to prevent an improper user from entering the 
VLAN by deleting the MAC address of the network device that is not performing communication 
from the VLAN information database 1 00 and assigning the default VLAN group to the 
connection port of the interconnecting device that is not performing communication. 

[0077] Fig. 6 shows an exemplary hardware structure of the network administration apparatus 10. 
The network administration apparatus 10 includes a CPU 700, a ROM 702, a RAM 704, a 
communication interface 706, a hard disk drive 708, a database interface 710, a floppy disk 
drive 71 2 and a CD-ROM drive 714. The CPU 700 operates based on at least one program 
stored in the ROM 702 and RAM 704. The communication interface 706 allows the 
communication with the network administration apparatus through the network. The database 
interface 71 0 writes data into a database and updates the contents of the database. The hard 
disk drive 708, that is an example of a storage device, stores setting information and the 
program for the operation of the CPU 700. 
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The floppy disk drive 71 2 reads data or a program from a floppy disk 720 to provide the 
read data or program to the CPU 700. The CD-ROM drive 71 4 reads data or a program from a 
CD-ROM 722 to provide the read data or program to the CPU 700. The communication 
interface 706 can be connected to the network administration apparatus so as to perform data 
transmission and data receiving. The database interface 710 can be connected to a database 
724 so as to perform data transmission and data receiving. 

Software executed by the CPU 700 is provided to a user while being stored in a recording 
medium such as the floppy disk 720 or the CD-ROM 722. The software stored in the recording 
medium may be compressed or not-compressed. The software is installed from the recording 
medium into the hard disk drive 708, and is then read into the RAM 704 so that the CPU 700 
executes the software. 

The software provided while being stored in the recording medium, that is the software to 
be installed into the hard disk drive 708, functionally includes a receiving module, a detecting 
module, a storing module, a database-updating module, and a setting module. Operations that 
are to be executed by the CPU 700 in accordance with instructions of the respective module to 
the computer are the same as the functions and operations of the corresponding components 
in the network administration apparatus 10 of the present embodiment, respectively, and 
therefore the description thereof is omitted. 

A part or all of the functions and operations of the network administration apparatus 10 
according to the embodiment described in the present application can be stored in the floppy 
disk 720 or the CD-ROM 722 shown in Fig. 6 as an example of the recording medium. 

These programs may be read directly into the RAM from the recording medium, or read into 
the RAM after being installed into the hard disk drive from the recording medium. Moreover, 
the above-mentioned programs may be stored in a single recording medium or a plurality of 
recording media. Furthermore, the programs may be stored while being encoded. 

As the recording medium, other than the floppy disk and the CD-ROM, an optical recording 
medium such as a DVD or a PD, a magneto-optical recording medium such as an MD, a tape- 
like medium, a magnetic recording medium, or a semiconductor memory such as an IC card or 
a miniature card can be used. Moreover, a storage device such as a hard disk or a RAM provided 
in a server system connected to an exclusive communication network or the Internet may be 
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used as the recording medium, so that the program can be provided to the network 
administration apparatus 1 0 through the communication network or the Internet. Such a 
recording medium is used only for manufacturing the network administration apparatus 10 and 
it is therefore apparent that manufacturing or selling such a recording medium as business can 
constitute infringement of the right based on the present application. 

[0084] As is apparent from the above, according to the present invention, a network administration 
apparatus, a network administrating program, a network administrating method and a 
computer network system that allow a high-security MAC address-based VLAN to be formed in 
which the VLAN setting can be performed efficiently without setting the MAC address by the 
network administrator. 

[0085] Although the present invention has been described by way of exemplary embodiments, it 
^ should be understood that those skilled in the art might make many changes and substitutions 
CP without departing from the spirit and the scope of the present invention which is defined only 
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by the appended claims. 
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